Microsoft's Hyderabad Cloud Region Data Residency Claims Face Scrutiny
Microsoft's new cloud region in Hyderabad, India, offers "eligible sensitive workloads" but processing of AI services may occur elsewhere, raising questions for regulated industries and compliance.
Microsoft informed its Indian customers on September 21 that "eligible sensitive workloads" could run in its new Hyderabad cloud region, but this capability is contingent on "supported services becoming available." This qualification is critical for businesses in sectors like banking, insurance, and healthcare, which are increasingly moving sensitive data to AI tools and must navigate India's complex data localization rules.
The company designated the India South Central region, its fourth in the country, as a "strategic hub" for Asia and the Global South and announced all its Indian regions are now "AI-enabled." Microsoft Foundry, a platform for building AI applications, is also slated for availability in the region soon. Several major Indian companies, including HDFC Bank, have reportedly signed up.
While Microsoft states its Indian regions are "aligned with MeitY guidelines," it does not specify these guidelines and places the compliance burden on the customer. "Customers remain responsible for determining which requirements apply to their organizations and workloads," the company noted.
The core issue lies in the distinction between data at rest and data in motion. Microsoft's documentation separates these, indicating that while data may be stored in Hyderabad, prompts and responses from AI models can be processed in other locations, depending on the deployment chosen by the customer. Options range from global processing to specific "Data Zones," meaning data stored in India could potentially be processed elsewhere.
Further complicating matters are tools like Azure Key Vault and Customer Lockbox, which are promised for the Hyderabad region "as supported services become available," with no clear indication of their current status. Additionally, the US CLOUD Act allows U.S. authorities to access data controlled by U.S. companies, regardless of its physical location, adding another layer of complexity for data managed in India by Microsoft.